#MOZILLA BUGZILLA PASSWORD#

'We have kicked off a larger project to better our practices around data, including with respect to the various non-Mozilla projects we support.

#MOZILLA BUGZILLA PASSWORD#

Users of, the official Mozilla bug tracker website that's based on the Bugzilla platform, are not affected by this incident if they didn't also have accounts on the Bugzilla testing server and didn't use the same password in both places.įollowing the information disclosure on the Mozilla Developer Network, 'we began several remediation measures, including a review of data practices surrounding user data,' said Joe Stevensen, operations security manager at Mozilla, in a separate blog post Wednesday. Nevertheless, Bugzilla maintainers notified all affected users and advised them to change any similar passwords they may have, he said. Since the database originated from a development server that was used to test potentially insecure Bugzilla builds, many users likely had passwords for their accounts that were not reused elsewhere, Côté said. 'As soon as we became aware, the database dump files were removed from the server immediately, and we've modified the testing process to not require database dumps,' Côté said Wednesday in a blog post. The files had been generated during the migration of a testing server for early builds of the bug tracking software, according to Mark Côté, the Bugzilla project's assistant lead. Browse free.The new data security breach disclosed Wednesday is similar and also resulted from database dump files being left in an unprotected location on a server for around three months beginning May 4th. We have notified the relevant law enforcement authorities about this incident, and may take additional steps based on the results of any further investigations.įor more details, please see our FAQ document. That’s why we publish security bugs once they’re no longer dangerous, and it’s why we’re writing a blog post about unauthorized access to our infrastructure. Openness, transparency, and security are all central to the Mozilla mission. In other words, we are making it harder for an attacker to break in, providing fewer opportunities to break in, and reducing the amount of information an attacker can get by breaking in. We are reducing the number of users with privileged access and limiting what each privileged user can do. As an immediate first step, all users with access to security-sensitive information have been required to change their passwords and use two-factor authentication. We are updating Bugzilla’s security practices to reduce the risk of future attacks of this type.

The version of Firefox released on August 27 fixed all of the vulnerabilities that the attacker learned about and could have used to harm Firefox users. We have no indication that any other information obtained by the attacker has been used against Firefox users. We believe that the attacker used information from Bugzilla to exploit the vulnerability we patched on August 6. The account that the attacker broke into was shut down shortly after Mozilla discovered that it had been compromised. We are also making improvements to Bugzilla to ensure the security of our products, our developer community, and our users. Mozilla has conducted an investigation of this unauthorized access, and we have taken several actions to address the immediate threat. We believe they used that information to attack Firefox users. It is in the same spirit of openness that we are disclosing today that someone was able to steal security-sensitive information from Bugzilla. While most information in Bugzilla is public, Bugzilla restricts access to security-sensitive information, so that only certain privileged users can access it. It’s a tool for coordinating among our many contributors, and a focal point for community interactions. The Bugzilla bug tracker is a major part of how we accomplish our mission of openness at Mozilla.

Mozilla bugzilla